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I. Introduction 

Cook County Health (CCH) Corporate Compliance incorporates two (2) distinct Compliance 
Programs: CCH as a provider of health care services and the CountyCare Medicaid Health Plan. 
Provider services occur within both CCH hospitals (John H. Stroger, Jr. Hospital of Cook County 
and Provident Hospital of Cook County), multiple outpatient clinics, correctional medicine at the 
Cook County Jail and Juvenile Temporary Detention Center, and the Cook County Department of 
Public Health. It also includes physicians and others that provide direct care to patients, and 
workforce members not directly involved in patient care. Although the CountyCare Medicaid 
Health Plan’s Compliance Program is addressed through a separate annual report, both programs 
function at the system level and are committed to the mission of Cook County Heath: 

“To deliver integrated health services with dignity and respect regardless of a patient’s 
ability to pay; foster partnerships with other health providers and communities to enhance 
the health of the public; and advocate for policies which promote and protect the physical, 
mental and social well-being of the people of Cook County.” 

Corporate Compliance supports CCH’s Mission through a departmental Mission updated and 
approved by the Audit and Compliance Committee of the Board of Directors on September 20, 
2018. The mission reads, 

“The Corporate Compliance Program upholds the mission, vision, and core values of Cook 
County Health by: 

■ Developing standards to guide everyone affiliated with CCH to “Do the Right Thing” 
• Increasing compliance awareness through education and training 

■ Promoting collaboration, honest behavior, mutual respect, and professional 
responsibility 

to support compliance with applicable laws, regulations, and system-wide policies.” 

Corporate Compliance similarly updated the Compliance Vision statement: 

“To ensure safeguards are in place for our patients, health plan members, health plan 
providers, the residents of the county of Cook, and our workforce members, staff, and 
the public at large, the Corporate Compliance Program will be a resource to everyone 
affiliated with and cared for by Cook County Health.” 

(For the purposes of this statement, “affiliated” is defined as all patients, health plan 
members, health plan providers, the residents of the county of Cook, and workforce 
members that include employees, medical staff, house staff, Board members, volunteers, 
students, partners, consultants, agency personnel, and vendors.) 

This Annual Report presents the activities throughout County fiscal year 2018 of the CCH 
Provider Corporate Compliance Program under the executive leadership of Cathy Bodnar, Chief 
Compliance and Privacy Officer, and the operational leadership of Dianne Willard, Compliance 
Officer. This report also serves to demonstrate the effectiveness of the compliance program by 
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looking at infrastructure, communication strategy and channels. In addition, this report provides 
an assessment of the CCH Provider Compliance Program by using the seven (7) Compliance 
Program Elements of a comprehensive compliance program delineated by the Office of Inspector 
General (OIG). 


II. Building Blocks - Program Infrastructure and Scope 

The Annual Report begins with a look at the activities of the Program that incorporate efforts to 
foster an infrastructure that produces a comprehensive compliance program. The existing 
Departmental Organization Chart follows: 



The lightly shaded positions indicate the new hires within FY18. Four (4) of the 7-positions within 
Corporate Compliance were filled within the fiscal year, including the Compliance Officer 
assigned to CountyCare. Although this placed a significant strain on the existing resources, the 
performance by the existing team members was noteworthy. Management of the core elements 
of the Program continued while an individualized development plan for each new team member 
was undertaken. This was critical to the success of each individual and the Program overall. 


Corporate Compliance Program Scope 


Cook County Health activities that fall into the Corporate Compliance purview are: 

■ Interpretation of laws, rules, and regulations and organizational policy as they relate 
to Corporate Compliance; 
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■ Accurate Books and Records; 

■ Anti-kickback Activities; 

■ Conflict of Interest; 

■ Emergency Medical Treatment and Labor Act (EMTALA); 

■ False Claims; 

■ Financial Integrity; 

■ Fraud, Waste, and Abuse; 

■ Integrity in both Marketing and Purchasing Practices; 

■ Patient Privacy, Confidentiality, and Security (HIPAA); 

■ Research, Clinical Trials, and Grant Compliance; and 

■ Undue Political Activity/ Operational Influence. 


III. Being Present — Communication — Fostering Transparency 

A. Communication Strategy 

The ongoing organizational compliance communication strategy has been to increase the 
CCH workforce awareness of the following topics: 

■ Code of Ethics; 

■ Privacy, Confidentiality, and Security; 

■ Accessibility of the Compliance Officer and the compliance team; 

■ Availability through multiple modalities; 

■ Responsibility to report potential/actual issues; and 

■ Non-retaliation. 

B. Communication Channels 

Within FY18, the Corporate Compliance Program communicated the aforementioned 
topics utilizing multiple formats: 

■ E-mail communications; 

■ Organizational newsletters (System Briefs); 

■ Record Retention guidance; 

■ Annual education; 

■ Screen savers; 

■ Attendance/presence at team meetings; 

■ Compliance Program business cards; 

■ Pens with the compliance hot line number; 

■ Privacy Protector wrist bands; 

■ Code of Ethics posters; and 

■ Dual employment and conflict of interest reporting. 
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IV. Compliance Program Structure: Performance of the Elements 


Element l 

The development and distribution of written Code of Ethics, as well as written policies and 
procedures that promote the hospital’s commitment to compliance (e.g., by including adherence 
to compliance as an element in evaluating managers and employees) and that address specific 
areas of potential fraud, such as claims development and submission processes, coding and 
billing risk areas, and financial relationships with physicians and other healthcare 
professionals. 

A. Policies and Procedures & Work Plan Activities 

Policies and Procedures 

Developed, updated, and performed triennial reviews on multiple system policies 
related to general compliance, governance, and HIPAA. Functioned as a reviewer for 
numerous organizational policies with compliance and/or privacy elements. Continue 
to participate on the CCH Policy Review Committee to ensure uniform system-wide 
standards are met. 

Work Plan Activities 

In addition to policy and procedure activity, Corporate Compliance worked with 
operational areas to assess compliance with procedures and/or regulatory 
requirements. 

■ Annual Education 

Responsibility for the ongoing operations and day-to-day management of the 
CCH electronic learning management system (LMS) for all mandatory annual 
training for the entire CCH workforce (employees and contractors) was 
transitioned to Wayne Wright, Director of Organizational Development and 
Training in Human Resources. 

Corporate Compliance remained subject matter expert for two (2) mandatory 
annual education modules, Fraud, Waste, and Abuse and Code of Ethics. Both 
modules were updated in to comply with regulatory and contractual 
requirements. In addition to maintaining responsibility for other elective 
modules relating to safeguarding protected health information. 

■ Record Retention 

As a government entity, all documents must be reviewed to determine if they 
are considered “public records.” Public record is defined in 50 ILCS 205/3 is 
defined as “( a)ny book, paper, map, photograph or other official 
documentary material, regardless of physical form or characteristics, made, 
produced, executed or received by any agency...or in connection with the 
transaction of public business and preserved...as evidence of the 
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organization , function, policies, decisions, procedures, or other activities 
thereof, or because of the informational data contained therein. 

CCH follows an approved Application for Authority to Dispose of Local 
Records, known as the Record Retention Schedule. The Schedule dates back to 
1985, it contains 1,237 pages with 4,395 different records and retention 
periods. Over the past year, Corporate Compliance has requested and received 
permission to destroy each record on the Records Retention Schedule based 
upon the regulatorily defined retention period. 

With the completion of the new Professional Building at 1950 West Polk, 
Corporate Compliance coordinated significant efforts to educate staff on record 
retention and appropriate record destruction. Corporate Compliance also 
worked with Health Information Management to walk through each floor of 
the Administrative Building and communicate proper identification and 
retention of documents prior to the Administrative Building being vacated by 
a majority of its workforce. 

Departmental efforts with the aforementioned activity deferred a project to 
update the current Record Retention Schedule to a leaner, more intuitive 
document for Cook County Health. This project remains on the Corporate 
Compliance work plan for FY19. 

■ Dual Employment and Accounting of Disclosure Surveys 

To support organizational transparency, worked with Business Intelligence to 
internally develop a survey for all Cook County Health employees that 
combines two (2) elements, dual employment and conflict of interest. 

Completion of an annual Dual Employment survey is required whether or not 
a CCH employee participates in external employment. This requirement is 
promulgated by the Rules of the Board of the Cook County Commissioners, 
CCH Dual Employment Policy and CCH Personnel Rules. 

Historically, a subgroup of CCH employees, those that influence procurement 
or function in any decision-making capacity on behalf of CCH, were required 
to disclose additional information related to external relationships and 
activities. The purpose of this survey is to assess whether a conflict of interest 
exists. This survey is a mandatory requirement pursuant to the CCH Conflict 
of Interest policy. This year, the conflict of interest questions were incorporated 
with the dual employment questions resulting in one survey for all employees. 
This survey collects employee disclosures for review by leadership. 
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The survey requires a two-step review process. Once completed by an 
employee, the survey is submitted to their operational leader. The operational 
leader reviews the submission. Once reviewed and approved, the survey is 
routed for a secondary review by the operational leader’s supervisor. At each 
step of the review, the reviewer has the ability to reject a submission, sending 
the survey back to the individual for more specificity. Summary information 
will be compiled and shared with the Corporate Compliance Executive Steering 
Committee. 

■ 340B Compliance 

Administered through the Health Resources and Services Administrations 
(HRSA) Office of Pharmacy Affairs, the 340B Drug Pricing Program has 
significant program integrity requirements. Corporate Compliance continued 
to function as a resource for the organization’s 340B Drug Pricing Program 
managed within the Department of Pharmacy that requires drug 
manufacturers to provide outpatient drugs to eligible health care organizations 
such as CCH at significantly reduced prices. 


Element 2 

The designation of a Chief Compliance Officer and other appropriate bodies, e.g., a corporate 
compliance committee, charged with the responsibility of operating and monitoring the 
compliance program, and who reports directly to the CEO and the governing body. 


B. 


Compliance Office and Committees 

The graphic below illustrates the communication and reporting structure. Cathy Bodnar, 
the Chief Compliance & Privacy Officer, reports to the CCH Audit & Compliance 
Committee of the Board and the CCH Chief Executive Officer. In turn, the CCH Audit & 
Compliance Committee of the Board and the CCH Chief Executive Officer each report to 
the CCH Board of Directors. 
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The primary duties of the Chief Compliance & Privacy Officer include the following: 

■ Serving as an internal consultant and resource for compliance and matters; 

■ Overseeing and monitoring the ongoing functions of the Corporate Compliance 
Programs for both the CCH provider side of the system and the CountyCare health 
plan; 

■ Participating in regular, CCH-wide risk assessments to understand potential 
vulnerabilities; 

■ Acting as the Privacy Officer for CCH to assure compliance with HIPAA regarding 
protection of patient and member health information; 

■ Reporting on a regular basis to the CCH governing bodies; 

■ Periodically revising the Corporate Compliance Program Plan, with input from the 
Audit & Compliance Committee of the Board of Directors and Executive 
Management in light of changes directed to the needs of CCH and the laws and 
policies of federal, state, and county bodies; 

■ Developing, coordinating and participating in training programs that focus on the 
elements of the Corporate Compliance Program and providing training such that 
workforce members are knowledgeable of and comply with the Code of Ethics, 
compliance policies, laws and regulations; 

■ Coordinating and overseeing compliance auditing and monitoring activities; 

■ Responding to reports of issues or suspected violations related to compliance by 
independently investigating these matters, as appropriate, and working with 
operational leadership, Human Resources, and General Counsel in the 
determination of corrective action warranted based on policies; 

■ Assuring, through consultation with Human Resources and General Counsel, that 
guidance provided through CCH disciplinary policies are applied fairly, equitably, 
appropriately, and consistently; 

■ Developing policies and programs that encourage CCH personnel to report 
suspected fraud and other improprieties without fear of retaliation or retribution; 
and 

■ Reviewing and incorporating updated compliance, privacy, and security language 
within agreements and contracts to require third party vendors’ adherence to 
applicable regulations and laws. 

The Audit & Compliance Committee of the Board advises the CCH Board of 
Directors regarding the implementation of standards and processes to assure 
professional responsibility and honest behavior, compliance with regulatory 
requirements, and risk management. 

In addition to the aforementioned relationships, the Chief Compliance and Privacy Officer 
receives support and guidance from the internal Corporate Compliance Executive 
Steering Committee, an assembly of executive leaders within CCH, including but not 
limited to, the CEO, Deputy CEO, System Director of Internal Audit, Chief Medical Officer, 
and others. 
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Element ‘A 

The development and implementation of regular, effective education and training programs for 
all affected employees. 

C. Education and Training 

1. New Employee Orientation 

Presented an “Introduction to Corporate Compliance and HIPAA”, at twenty-seven 
(27) orientation session speaking to over 1,200 workforce members. 

2. Targeted Education 

Provided thirty-seven (37) additional education training sessions to 485 attendees. 
Continued utilizing interactive training sessions which focused on story-telling as 
a means to communicate information on HIPAA and CCH policies. Focused on 
current matters brought to Corproate Compliance attention, the impact on 
patients, and proactively improving compliance to areas such as, 
o Resident program coordinators; 
o Residents in surgical units; 
o Patient Access Department; 
o Outpatient clinics; 
o CORE Center; 

o Physical Therapy/Occupational Therapy; 
o Oak Forest Mail Order Pharmacy; and 

o Correctional Health at Juvenile Temporary Detention Center. 

3. Annual Compliance Education 

As noted earlier in this report, updated two (2) annual education modules on the 
Code of Ethics and Fraud Waste and Abuse. 

Element 4 

The maintenance of a process, such as a hot line, to receive complaints, and the adoption of 
procedures to protect the anonymity of complainants and to protect whistleblowers from 
retaliation. 

D. Effective Lines of Communication - Receiving and Responding to Complaints 

1. Infrastructure Activities 

a. Assisted our workforce members through: 

■ A hot line service by a third party to preserve anonymity if 
desired. The individual is given a code number related to their 
report, and can call back or check the website using that code 
number to review comments and updates. 

■ A separate toll-free number for privacy breaches. 
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■ Expanded role in collaborating with Patient Relations to assist 
in resolving compliance-related issues. 

b. Managed two (2) e-mail addresses for Compliance 
f compliance@cookcountyhhs .orgj and Privacy 
f privacv@cookcountvhhs.org~) . 

c. Established and engaged internal and external resources to assist with 
investigations and provide governmental and national perspectives on 
compliance issues. 

d. Identified trends and patterns to mitigate organizational risks and 
facilitate operational improvement. 

e. Presented trends and patterns to the Audit and Compliance Committee 
of the Board. 

2. Process for Responding to Inquiries, Issues and Complaints 

The work flow process follows: 

a. Investigate the allegation; 

b. Determine the area(s) affected; 

c. Collaborate with operational leadership and appropriate departments; 

d. Review and follow organizational policy, federal, state, and county 
regulations related to the incident for mitigation and remediation. 
These may include further auditing of documentation, mitigating harm 
and potentially informing the appropriate government entity; 

e. Follow HIPAA breach notification rules that require sending a 
notification and apology letter to the affected individual(s), reporting 
to the Centers for Medicare and Medicaid (CMS), and, in the case of 
breaches that affect over 500 individuals, notifying the media; 

f. Collaborate with operational area to determine and facilitate a 
corrective action plan including education as needed; 

g. Respond to the complainant; and 

h. Respond to governmental entities as required by law. (e.g. CMS, OCR, 
HFS). 

All contacts brought to the attention of Corporate Compliance are tracked through 
a web-based tracking tool. The Compliance Program utilized one vendor for 8- 
years to maintain consistency in tracking and monitoring. With the advancement 
of technology, it was prudent to assess the current marketplace. A Request for 
Proposal was posted, and six (6) vendors responded. A committee evaluated the 
respondents and chose a vendor based upon their commitment to provide hands- 
on management of the project and full implementation of the Compliance Issue 
Tracking Tool and leveraging a partnership with Salesforce, an existing CCH 
vendor currently utilized within Human Resources, to provide the software 
platform. 
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The overarching goal of the process is to assure consistency and to implement 
protections for our patients/members, the organization, our workforce, the 
government and the taxpaying public at large. The diagram that follows illustrates 
the approach to incident investigation and ensures that all the causes are 
uncovered and addressed by appropriate actions. 



3. Contact Volumes 

In FY18, 740 identified contacts were documented for the CCH Provider 
Compliance Program. The chart that follows illustrates the year-over-year activity 
which shows an increase of 120% compared to the previous fiscal year. 
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4. Contact Breakdown by Category 

Categories have been defined that parallel the CCH Code of Ethics. The inclusion 
of a contact in a specific category does not substantiate the contact as a concern; 
rather it classifies the contact within a defined category. 
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The categories are classified as follows: 

■ Accurate Books and Records 

■ Conflict of Interest 

■ Contracts* 

■ False Claims 

■ Healthcare Fraud, Waste and Abuse 

■ HIPAA Privacy, Confidentiality and Security 

■ Human Resources 

■ Research 

■ Regulatory/Policy 

■ Theft 

■ Other 


* Based upon the volume of activity surrounding contract review, separated this 
category from the previous category of Regulatory/Policy/Contract 


5. FY18 Contacts by Category 
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The majority of the contacts, 237 or 32%, were categorized within HIPAA Privacy. 
This percentage is consistent with previous years. Of the documented contacts 
categorized as HIPAA Privacy, approximately 15% or 37 contacts were confirmed 
privacy breaches that resulted in a total of 82 patient notifications. 

The CCH Provider side of the Compliance Program provides support to the health 
plan for privacy issues. CountyCare experienced one (1) privacy breach that 
resulted in a total of five (5) member notifications. The one CountyCare breach in 
FY18 was caused by a Business Associate. 

6. FYl8 Contact Status 

Of the 740 contacts were addressed throughout FY18, 96% or 709 contacts were 
resolved. Of the contacts resolved, More than 99% were either managed internally 
by Corporate Compliance or Corporate Compliance partnered with another area to 
address the concerns raised. Less than 1% were referred to other areas external to 
Corporate Compliance for management and follow-up. This metric is consistent 
year-over-year. The remaining 31 contacts were remained open at the end of the 
fiscal year and were carried over to FY19. 

7. FY18 Proactive vs. Reactive 
Of the 740 provider contacts managed during FY18, 

29% or 218 contacts were proactive. The proactive 
category is defined as subjects, brought to the 
attention of Corporate Compliance by individuals 
seeking guidance prior to the occurrence of an 
event or activity. This percentage has decreased 
from 40% in FY17. The remaining 522 contacts or 
71% were reactive. Reactive contacts are defined as 
contacts that occurred that were reported to Corporate Compliance after the 
occurrence. 

Element a 

The development of a system to respond to allegations of improper/illegal activities and the 
enforcement of appropriate disciplinary action against employees who have violated internal 
compliance policies, applicable statutes, regulations or Federal health care program 
requirements. 

E. Enforcing Standards 

Broadened the scope of Standards enforcement through: 

1 . Breach Assessments. Reviewed investigations and provided remediation guidance 
to operational areas to minimize and/or eliminate breaches in the future and, utilized 
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the CCH Sanction Policy and Personnel Rules, to provide leadership guidance for 
disciplinary action. 

2 . Breach Notification. Investigated all instances of lost or stolen patient information, 
including paper and electronic. For all instances in which the data loss constitutes a 
breach as defined by the Breach Notification Rule, the breach notification 
requirements to the patient, the Secretary of HHS, and the media are completed. 
Corrective action plans are created and executed to improve the processes and counsel 
the physicians and employees involved. 

3 . Conflict of Interest. Provided guidance and developed Conflict Management Plans 
to preserve the integrity of the decision-making process. 

4 . Investigations Resulting in Employee Related Corrective Actions. HIPAA 
and Conflict of Interest complaints were investigated and resulted in providing 
leadership guidance to remediate the situations and avoid repetition of the incident. 

5 . Partnerships with Governmental Agencies. Corporate Compliance has engaged 
both state and federal agencies (e.g. the Department of Healthcare and Family Services 
(HFS) Office of the Inspector General, Medicaid Fraud Control Unit, Office for Civil 
Rights, Federal Bureau of Investigations, and the Secret Service) on a variety of 
matters. Additionally Compliance has worked with the Cook County Office of the 
Independent Inspector General. 

Element 6 

The use of audits and/or other evaluation techniques to monitor compliance and assist in the 

reduction of identified problem area. 

F. Auditing and Monitoring 

1 . The Corporate Compliance Program conducted ongoing HIPAA auditing and 
monitoring during the relocations out of the Administrative building as follows: 

o Providing proactive record retention guidance throughout the move; 
o Monitoring garbage bins and vacated offices for PHI and working with 
operational leadership to educate staff when PHI was found; 
o Engaging Health Information Management when original medical record 
information was identified; 

o Communicating to the appropriate operational area(s) when other non-HIPAA 
contacts were identified related to the move (e.g. sharps and equipment found.) 

2 . The Corporate Compliance Program also served a resource to Internal Audit for 
outpatient coding expertise. 
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G. Risk Assessment 

The Corporate Compliance Program risk assessment process is dynamic and adjustments 
are made throughout the year to respond to emerging issues with the resources available. 
This report highlighted activities that minimized risk through the introduction and 
enforcement of policies and standards, auditing and monitoring, education, and issue 
investigations with corrective action plans as appropriate. 

Through surveys of executive leadership and key thought leaders within the organization, 
industry risks, and through the course of activities within prior fiscal years, the following 
areas were assessed in FY18: 

■ Securing Protected Health Information in paper and electronic and paper format 
through encryption and secure storage devices; 

■ Monitoring patient data to ensure accurate registration and deter identity theft and 
merged electronic health records; 

■ Directing Supply Chain Management during contract negotiations in the areas of 
compliance, privacy and security; 

■ Ensuring documentation supports the services performed through accurate code 
assignment; 

■ Defining contractual parameters of governmental Managed Care Plans excluding 
CountyCare; 

■ Assuring sanction screening was performed during the onboarding process for 
employees and vendors; 

■ Monitoring the 340B Drug Pricing Program through Pharmacy; 

■ Collaborating with Research to ensure regulatory requirements are followed; 

■ Guiding leadership in Record Retention and Storage requirements; and 

■ Working with physicians through the Illinois Drug Prescription Monitoring 
Program to eliminate fraudulent controlled substance prescriptions. 


Element 7 

The investigation and remediation of identified systemic problems and the development of 
policies addressing the non-employment or retention of sanctioned individuals. 

Sanction Screening Checks 

■ Continued to address regulatory requirements to avoid employing, engaging, 
contracting or agreeing with any individual or entity that is excluded or 
“sanctioned” from participation in a federal health care program or who is 
debarred from participation in federal procurement or non-procurement 
programs for the provision of goods or services. 

■ Determined, through an independent third party, no excluded or sanctioned CCH 
workforce members or vendors were identified throughout this fiscal year. 
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V. Looking Ahead 


Overarching priorities have been established for CCH Corporate Compliance, to: 

■ Serve as a resource for our patients, our staff, and the public at large; 

■ Investigate all contacts/complaints brought to the attention of the Program; 

■ Promote the CCH Corporate Compliance Program internally and externally. 

In addition, as noted earlier, through an annual risk assessment with executive leadership and 
key thought leaders, identification of emerging issues, and through the course of activities within 
prior fiscal years priorities have been identified. The Corporate Compliance Program will 
primarily focus on analysis and risk reduction related to fraud, waste, and abuse initiatives and 
continue to review, update and implement compliance policies and procedures. 

FY19 priorities on the CCH provider side will focus on the following: 

■ Communication of importance of safeguarding hard copy Protected Health Information 
(PHI) to workforce members and their departments and provide guidance on record 
retention parameters and secure destruction processes as warranted; 

■ Development and compilation of a leaner, intuitive Records Retention Schedule for 
submission to the Local Records Commission. Once approved, append the current 
Records Retention policy and communication the update to the CCH workforce; 

■ Continuation of our partnership with IT Security to examine processes to safeguard 
electronic protected health information or ePHI as technological challenges arise (e.g. 
social media, texting, image sharing, etc.); 

■ Collaboration with Revenue Cycle operations to deter identity theft and merged electronic 
health records; 

■ Participation in continued oversight of the 340B Drug Pricing Program; 

■ Communication to accentuate the need for providers to manage their prescription activity 
with the Illinois Drug Prescription Monitoring Program to eliminate fraudulent controlled 
substance prescriptions; 

■ Oversight of auditing and monitoring code assignment based on medical record 
documentation and documentation guidelines; and 

■ Assessment of compliance with third party Managed Care contracts. 


Page 17 







